php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #66048 temp. directory is cached during multiple requests
Submitted: 2013-11-07 15:51 UTC Modified: 2015-05-12 14:21 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: manuel-php at mausz dot at Assigned: jpauli
Status: Closed Package: *Configuration Issues
PHP Version: Irrelevant OS:
Private report: No CVE-ID:
 [2013-11-07 15:51 UTC] manuel-php at mausz dot at
Description:
------------
PHP's temp. directory get cached during multiple requests because php_shutdown_temporary_directory() is only called during module shutdown.

Should be during request shutdown.


Test script:
---------------
no script, but instructions:
- set up mod_php + two vhosts with different sys_temp_dir ini-setting
- only allow *1* worker (StartServers = MinSpareServers = MaxSpareServers = MaxClients = 1)
- turn keepalive off
- request sys_get_temp_dir() from both vhosts
-> temp dir will be the same


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2013-12-30 17:33 UTC] manuel-php at mausz dot at
Just for reference: https://github.com/php/php-src/pull/524 (still open)
 [2015-04-05 14:43 UTC] php at spam dot lifeforms dot nl
We are affected by this issue on mod_php 5.6.7 on FreeBSD and Ubuntu since we have started to use a separate temporary directory for every separate VirtualHost, such as:
  php_admin_value sys_temp_dir /home/foo/tmp

Unfortunately the sys_get_temp_dir() return value gets mixed up between virtual hosts.

It's easy to reproduce, just use Apache with mod_prefork and mod_php5. Configure a different 'sys_temp_dir' value for two virtualhosts, and put a script such as:

<?php
echo sys_get_temp_dir();

Reload this script on both virtualhosts a few times in two browser tabs, and you will see the value frequently switch from one vhost's sys_temp_dir value to another one's (on both OS). On FreeBSD even /tmp is returned sometimes.

It appears that the cause of this mixup is a cache in main/php_open_temporary_file.c:

PHPAPI const char* php_get_temporary_directory(TSRMLS_D)
{
    /* Did we determine the temporary directory already? */
    if (temporary_directory) {
        return temporary_directory;
    }

This is supposed to be cleaned by php_shutdown_temporary_directory().
However, that is called at module shutdown and not at request shutdown.
Therefore I understand it's liable not to be cleaned between requests, meaning that different VirtualHosts will re-use each other's temporary directory.

If in Apache configuration MaxConnectionsPerChild is set to 1, so that Apache processes are never reused, the problem goes away (but this has serious performance implications). However this reinforces the idea that per-request cleanup of the value is not done.

In this PR https://github.com/php/php-src/pull/524 the PR author argued php_shutdown_temporary_directory() should be moved to php_request_shutdown(), however jpauli has registered some doubts.

For virtual hosting environments it's extremely useful to set the temp directory on a VirtualHost basis, and its malfunction causes issues for instance with Wordpress auto-updating, so it'd really be awesome if this bug could get some love and would like to help if we can.
 [2015-04-29 12:37 UTC] jpauli@php.net
Hello.

Can you test https://github.com/jpauli/php-src/tree/fix-66048 please ?

This should fix your problem.

Thx.
 [2015-04-29 19:24 UTC] php at spam dot lifeforms dot nl
The fix resolves the issue completely!

First built php7 master from source on Ubuntu 14.04 LTS to reproduce the problem on PHP7: yep!

Then built fix-66048: problem resolved! :)

I tried to apply the diff to 5.6.8 but wasn't immediately successful as it's quite different (error_clear_last and such), do you think it can be backported?
 [2015-05-12 14:17 UTC] jpauli@php.net
Automatic comment on behalf of jpauli
Revision: http://git.php.net/?p=php-src.git;a=commit;h=468e37fe027259fd0a61ac3a84cac1336f768005
Log: fix #66048 for PHP7
 [2015-05-12 14:17 UTC] jpauli@php.net
-Status: Open +Status: Closed
 [2015-05-12 14:21 UTC] jpauli@php.net
-Status: Closed +Status: Feedback
 [2015-05-12 14:21 UTC] jpauli@php.net
Please try using this snapshot:

  http://snaps.php.net/php5.5-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/

Fixed in PHP-5.5 and up
 [2015-05-12 14:21 UTC] jpauli@php.net
-Status: Feedback +Status: Closed -Assigned To: +Assigned To: jpauli
 [2016-07-20 11:38 UTC] davey@php.net
Automatic comment on behalf of jpauli
Revision: http://git.php.net/?p=php-src.git;a=commit;h=468e37fe027259fd0a61ac3a84cac1336f768005
Log: fix #66048 for PHP7
 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Mon Apr 24 07:01:38 2017 UTC